Overview

overview

10

Static

static

Windows Se...er.exe

windows7_x64

10

Windows Se...er.exe

windows10_x64

8

Resubmissions

25/06/2021, 20:08

210625-1ay8ymabc6 10

24/06/2021, 06:05

210624-z3rv4e1ed2 10

Analysis

  • max time kernel
    379s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    25/06/2021, 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windows Session Manager.exe

  • Size

    1.3MB

  • MD5

    000e2743bf3cb96cefc4be357765cec3

  • SHA1

    62b9b6afc91e349c56ce967985eec229f7db82aa

  • SHA256

    126f06426beeaaeea65331c5896590eb558405e5b924254e1aa17c3adc5c2fb3

  • SHA512

    b8298aed9d0ac929c9942ff8addce2a3b0e779093dad50fc99242542e8894fb0c45a5d4e60ed33691fc5fbcdeccfc9e50244dad6056500de8a28fddb6f6f275f

Score
10/10
xmrigevasionminerransomwarespywarestealer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 12 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • NTFS ADS 11 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:1844
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:1800
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:1772
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:1728
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:316
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:824
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:1332
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1472
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1296
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:1532
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1692
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1004
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:544
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                      PID:564
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall set currentprofile state off
                        3⤵
                          PID:816
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                        2⤵
                          PID:436
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode mode=disable
                            3⤵
                              PID:1516
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop SQLWriter
                            2⤵
                              PID:1624
                              • C:\Windows\SysWOW64\net.exe
                                net stop SQLWriter
                                3⤵
                                  PID:1780
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop SQLWriter
                                    4⤵
                                      PID:1976
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                  2⤵
                                    PID:1964
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop SQLBrowser
                                      3⤵
                                        PID:1808
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SQLBrowser
                                          4⤵
                                            PID:1772
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                        2⤵
                                          PID:1144
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MSSQLSERVER
                                            3⤵
                                              PID:1716
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLSERVER
                                                4⤵
                                                  PID:1396
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                              2⤵
                                                PID:1332
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop MSSQL$CONTOSO1
                                                  3⤵
                                                    PID:1384
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                      4⤵
                                                        PID:1548
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\UndoDismount.hta"
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  PID:1488
                                                • C:\Windows\system32\taskmgr.exe
                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                  1⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:1396
                                                • C:\Windows\explorer.exe
                                                  "C:\Windows\explorer.exe"
                                                  1⤵
                                                    PID:1332
                                                  • C:\Windows\system32\AUDIODG.EXE
                                                    C:\Windows\system32\AUDIODG.EXE 0x510
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:564

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/816-77-0x0000000075A71000-0x0000000075A73000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/1396-94-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download